Minutes of the meeting of the PAYMENT SERVICES STAKEHOLDER LIAISON GROUP

Transcription

1 PSD2 Stakeholder Liaison Group 1 of Minutes Minutes of the meeting of the PAYMENT SERVICES STAKEHOLDER LIAISON GROUP Held on 13 September 2016, At Committee Room C, FCA 25 The North Colonnade, London Present: Graeme Mclean, FCA (Chair) Nilixa Devlukia, FCA Jack Wilson, FCA Jody Whitehorn, FCA Samuel Condry, FCA Rezwan Malik, FCA Edward Corcoran, HM Treasury Millie Richardson, Association of Foreign Exchange and Payment Companies David Song, Payments UK Briony Krikorian-Slade, UK Cards Association Thaer Sabri, Electronic Money Association Andrew Hopkins, Building Societies Association Iris Kapelouzou, British Bankers Association (BBA) Faith Reynolds, FCA Consumer Panel & Consumer Network Tim Minall, UK Merchant Acquirers Forum Ali Imanat, Financial Fraud Action UK Michel Vaugiac, European Payment Institutions Federation Hamish MacLeod, Mobile UK Dominic Thorncroft, AUKPI Sophia Bantanidis, standing in for Ruth Wandhöfer of the European Banking Federation Payments Regulatory Expert Group Andrew Cregan, British Retail Consortium Andy Maciver, FDATA Apologies: Elizabeth Fraser, Payments UK Ruth Wandhöfer, European Banking Federation Payments Regulatory Expert Group Minute No. 1 Introduction The Chair welcomed attendees to the second meeting of the Stakeholder Liaison Group (SLG) reiterating that the purpose of the group is to engage with relevant stakeholders as the FCA develops its approach and guidance in response to the revised Payment Services Directive (PSD2). The Chair also reiterated the Actions

2 PSD2 Stakeholder Liaison Group 2 of following points: The FCA would not be taking any questions or addressing issues related to the recent European Union referendum result. The FCA s statement on this matter was read out. The role of the SLG is not to address concerns or issues that can only be addressed through the final text of PSD2 or HM Treasury s implementing regulations. 2 HM Treasury gave a brief update explaining that the consultation on implementing regulations for PSD2 was delayed to October, rather than August as planned. The consultation would last 6 weeks. 3 The Chair asked attendees to confirm the agenda for the meeting. No further discussion points were raised. 4 EBA consultation on strong customer authentication (SCA) and secure communication standards (SCS) The FCA gave an overview of the EBA s open consultation on regulatory technical standards which cover security for payment transactions (including the use of two factor authentication) and principles for how Account Information Services (AIS) and Payment Initiation Services (PIS) communicate with account servicing payment service providers (ASPSPs). Attendees were invited to provide their thoughts on the consultation. The following points were made: The SCA may not be future proofed with impact on contactless and the EUR150 cap particular areas for concern in the UK. The RTS principles seemed to be derived from previous SecurePay recommendations and were backwards looking not reflecting or incorporating the behavioural risk based security measures currently used by PSPs. It was noted that the EBA rationale for the exclusion of risk based measures was not very convincing. It was queried why AIS and PIS were obliged to comply with ISO standards (ISO 27001) that were more burdensome than those PSPs and EMIs needed to comply with. The requirement for PSPs to get security certificates from eidas providers was raised as an issue given there were not many providers available. It was suggested that the requirement to make passwords up of non-repeatable characters could make passwords less rather than more secure. It was noted that use of the term electronic remote payment risked confusion in the industry because of

3 PSD2 Stakeholder Liaison Group 3 of different uses of the term in the E-payment industry. FCA noted that contactless limits had been agreed at EUR50 given the UK industry s position where contactless limits are already set at 30 (higher than other EU member states). However attendees were asked for views on whether the EUR150 cumulative limit raised any particular issues. (Under the draft RTS, once EUR150 of low value SCA exempt transactions have been made i.e. through contactless, an authentication will be required from the customer before the card can be used without SCA). Attendees discussed transit specific examples where this could be problematic, for example if the card was only used as an alternative to an oyster card or if the limit had been nearly reached before a subsequent payment was attempted in a situation where authentication was not possible (such as on the underground). Generally a concern was that the limit could reduce flexibility for the industry to innovate and readily change. FCA invited a discussion of the Secure Communication aspects of the consultation with the following points raised: Limits on how many times AIS can access customers accounts (which is currently two times per day in the RTS) could impact on what the information could be used for and could possibly cut across industry initiatives. It was noted that customers could still authorise access more than twice a day. It was also noted that the limit had been introduced because of concerns by industry about the impact continuous access could have on ASPSP s online platforms. 5 Complaints Handling under PSD2 The Chair referenced industry work that had been undertaken on complaints and invited attendees to outline any thoughts on the new reporting requirements in the directive (article 101 dispute resolution). The following points were made: Attendees were considering how to delineate between payment services complaints and other complaints. They were looking at the options of implementing through a unified condensed timeline for all complaints vs. separate paths for payment services complaints and other types of complaints. The operational challenge was that banks had recently implemented DISP changes and incorporated these changes into staff training. PSD2 would create additional challenges. There were also questions about what constitutes exceptional circumstances and how payments complaints should be understood. It was noted that the definition of what is and isn t a payment services complaint is particularly relevant for firms who provide

4 PSD2 Stakeholder Liaison Group 4 of FX services as the question of whether FX is the primary or ancillary service i.e. whether the activity is in scope of the regulations already leads to difficulties. It was noted that payments complaints could be the most complicated for firms to deal with, this is especially the case for payments across different jurisdictions. It was suggested that consumers understanding of the complaints process was already difficult enough without payment services being stripped out and treated separately. FCA noted that while one simple complaints process was the optimum, the Directive did not provide much flexibility. Attendees discussed the Financial Ombudsman Service (FOS) implications of the complaints requirements. One attendee was concerned that complaints being lodged for small transaction amounts were leading to FOS charges of 450 per complaint. This was queried given that FOS deals only with complaints that have not been dealt with sufficiently by the PSP. It was also noted that data shows only a small amount of complaints actually go beyond three days which would suggest the 15 day time limit will only affect a small proportion of payment services complaints. It was also suggested that the potential for customers to complain about both payment initiation services and their ASPSP could increase complexity of complaints which would create additional burdens for the FOS. The group also discussed whether the complaints handling provisions captured businesses and corporates. FCA clarified this as their reading given article 101 refers to payment service users and has no derogation in the same way that article 102 (Alternative Dispute Resolution) does (at article 61). Attendees were asked whether their members collect data on complaints handling. Other than the reporting that is required by DISP (from credit institutions) one attendee noted that they issue good practice guidelines to their members on collecting complaints data. The FCA requested that attendees provide some scenarios which demonstrate the real world difficulties for PSPs of implementing the complaints handling provisions. This input was requested for 5 October. ALL

5 PSD2 Stakeholder Liaison Group 5 of Payments related Fraud reporting The FCA gave an overview of the requirement in article 96(6) of PSD2 to report statistical data on fraud related to different means of payment to the competent authority. It was noted that there has been no steer from the European Central Bank (ECB) or the EBA (to whom the data must be onward reported in an aggregate form) about the intention for the data or the level of detail required. However, the data would possibly be used to indicate whether SCA had been successful over the long term and could play a part in the ECB s single supervisory mechanism role. Attendees made the following points: It was suggested that a useful starting point for collecting statistical data on fraud could be to collect the value of fraudulent transactions as a percentage of turnover as it was likely all PSPs collected this data already. Attendees discussed the different types of fraud and the different drivers for collecting the data. Fraud data was collected in detail and easier to track where the PSP was liable. Other types of fraud data, such as for scams where customers are conned into authorising payments to fraudsters was less easy to collect in a uniform way. It was also suggested that different PSPs collected data about different aspects of the transaction it would not be possible for all PSPs to report the same, consistent cut of data. It was suggested that the more data can be collected on fraud and scams the more able the industry would be to identify patterns in behaviour and take action. 7 Any other business In relation to the EBA consultation on SCA and SCS, attendees were reminded to provide examples to the EBA of effective risk based analysis if they felt the need to include such an exemption in the final RTS. Forward agenda The Chair thanked everyone for attending and noted the next meeting would need to be rescheduled from the 12 October to the 14 October. Next meetings: 14 October November December

6 PSD2 Stakeholder Liaison Group 6 of Annex Participants Terms of reference FCA: Chair Graeme McLean Alternate Chair Andrew Laidlaw Banking & Payments Policy Nilixa Devlukia General Counsel s Division Jody Whitehorn Ops/Business Planning Daniel Buckland Supervision Rezwan Malik Consumer Redress Samuel Condry External: Aim HM Treasury Association of Foreign Exchange and Payment companies Association of UK Payment Institutions Electronic Money Association Mobile Broadband Group Payments UK GSMA UK Cards Association Building Societies Association British Bankers Association European banking Industry Payments Regulatory Expert Group Financial Data and Technology Association (FDATA) British Retail Consortium FCA Consumer Panel UK Merchant Acquirers Forum European Payment Institutions Federation Financial Fraud Action UK The aim of the SLG is to ensure productive liaison between the FCA (as competent authority) and the payment services sector in order to support the successful implementation of the revised Payment Services Directive by 13 January Role and purpose The SLG is comprised of relevant trade associations and representatives of other groups affected by or interested in the implementation of PSD2 (such as consumers and business customers). The SLG is intended as a forum to enable stakeholders to facilitate the FCA s engagement with the payments industry as it develops its approach to implementation of PSD2. The SLG will provide the FCA with information and advice about payment services for policy and operational planning purposes.

7 PSD2 Stakeholder Liaison Group 7 of The SLG will provide input into determining how stakeholders are best supported to comply with the PSD2 regime. The SLG will assist in the development of the FCA s revised Approach Document, perimeter guidance and any related Handbook changes. The FCA will keep the SLG updated on progress of implementation. The SLG will aim to ensure that payment services firms are aware of PSD2, understand its requirements and the FCA s proposed regulatory approach and are adequately prepared for its implementation. Scope of activity The SLG will inform the FCA s decision making and will assist in ensuring that PSPs and other affected payments firms are aware of the requirements of PSD2. The scope of the SLG will be limited to issues relevant to the FCA s role as competent authority. Membership The SLG will be made up of stakeholders representing the diversity of interests that are affected by PSD2, including the payments industry and customers. Members may nominate alternates for any meeting or request that an additional colleague attend with the prior approval of the Chair. The FCA may consider new applications for membership of the SLG. Such applications should be duly motivated. The FCA reserves the right to refuse such applications. Meetings and operating The SLG will normally meet every six weeks. Scheduled meetings can be brought forward or cancelled if necessary. The SLG may also review by written procedure issues that do not warrant a full meeting. The meetings will be chaired by Graeme Mclean (Head of Banking, Lending & Distribution Policy, FCA) with Andrew Laidlaw as alternate (Manager Banking and Payments). FCA staff will act as secretariat FCA will endeavour to issue agendas and any meeting papers at least 5 working days in advance of the meeting. The agenda will also be published on our website. Draft minutes will be circulated by the secretariat for agreement of the SLG within 5 working days of the meeting. They will subsequently be published on the FCA website.